Digital Footprint.

What is a digital footprint?

A digital footprint is the trail of data created by using the internet. The Canadian Centre for Cyber Security says this trail comes from the websites you visit, the emails you send and the information you submit or download online. The same idea applies to a whole organization, which leaves traces through its staff, its websites and the information it publishes.

What are active and passive digital footprints?

The Canadian Centre for Cyber Security describes two kinds. Active footprints come from deliberate actions, such as posting on social media, filling out online forms or agreeing to browser cookies. A cookie is a small file a website stores on a device.

Passive footprints are created without the person being aware. The Center says this data is often collected through monitoring tied to your IP address. Websites and applications may also install cookies without disclosure, use location tracking or log your activities.

Why does a digital footprint matter for security?

The Canadian Centre for Cyber Security says compromised digital footprints can lead to identity theft, issues with background checks and reputational harm. It also says phishing and website spoofing are common techniques that make a digital footprint more accessible to threat actors. Website spoofing means copying a real website.

The UK National Cyber Security Centre (NCSC) says publicly available information about an organization and its staff can be used to make phishing messages more convincing. It adds that senior management, board members and staff with privileged access are likely to be more attractive targets for attackers. Privileged access means broad rights over systems or data.

The Canadian Centre also notes that remote work can add risk. Sensitive data may be shared through devices and networks that do not have the appropriate security measures in place.

How do attackers use it?

CISA describes phishing as criminals trying to get people to open harmful links, emails or attachments that could request personal information or infect devices. CISA also says revealing too much online can give criminals information they can use to phish a person specifically.

How can you reduce your digital footprint?

The Canadian Centre for Cyber Security gives these actions:

• Train employees and raise awareness of how to handle information.
• Read the terms of an application before using it, and deactivate cookies if possible.
• Configure privacy and security settings to the highest and most restrictive settings available.
• Use anti-virus software, firewalls, multi-factor authentication, strong passwords and VPNs.
• Remove metadata from photos before sharing and posting them online. Metadata is hidden data stored inside a file.
• Permit access only to those with a need to know, and classify data by sensitivity.

The NCSC advises helping staff to manage their own digital footprints, especially senior management, board members and staff with privileged access.

How does it relate to the attack surface?

An attack surface is the set of points where an attacker could try to get in. A digital footprint is wider in meaning, because it covers the traces of people and organizations online. Related terms include attack surface, phishing and social engineering.

Is a digital footprint the same as a digital shadow?

The sources we read do not use the term digital shadow, so we do not treat the two as the same. Online footprint is a plain synonym for digital footprint.

Can you remove your digital footprint completely?

The sources we read do not say it can be removed completely. They describe steps that reduce it, such as stricter privacy settings and sharing less. Brandefense monitors the external areas where an organization’s traces can appear.